Passwordless Login with SMS Service Provider | SCAPI | B2C Commerce Storefront Reference Architecture

Use SMS to send verification codes to authenticate shoppers with the passwordless login feature of the Shopper Login and API Access Service (SLAS).

This guide includes instructions for integrating passwordless login with SMS by using either Agentforce Marketing or Amazon Simple Notification Service (SNS). SLAS doesn’t support SMS delivery of one-time passwords (OTPs). To have an OTP sent by SMS, use mode=callback and manage the SMS delivery from your callback.

Before You Begin

To complete the instructions in this guide, you must have:

An active B2C Commerce license.
An SMS service provider. For example, Agentforce Marketing or Amazon SNS.
Provisioned SMS short or long codes for each country where you have SMS recipients.

Other Considerations

Prior login: A shopper must log in via SLAS at least one time before requesting a passwordless login.
Registration: The shopper’s phone number must be registered with B2C Commerce.
Volume limits: Sending SMS message for passwordless login counts towards your overall volume.

Example A: Agentforce Marketing

SLAS passwordless login flow with Agentforce Marketing for SMS integration

This diagram illustrates the complete lifecycle of a passwordless login request. It begins when the storefront app calls SLAS with mode=callback. SLAS then delegates the OTP delivery to your backend server. Finally, your server authenticates with Agentforce Marketing to dispatch the SMS before returning a success response to SLAS.

Agentforce Marketing Prerequisites

An active Agentforce Marketing license with an SMS subscription.
Admin access for your Agentforce Marketing instance with permission to install apps.
An SMS country code and short code for your Agentforce Marketing instance.

👉 To provision an SMS short code, contact your Agentforce Marketing account representative.

Agentforce Marketing Configuration

1. Set Up Agentforce Marketing Server-to-Server Integration

Set up a server-to-server integration in Agentforce Marketing. This allows your backend to make API calls to Agentforce Marketing to send SMS messages. See Server-to-Server Integrations with Client Credentials Grant Type in Agentforce Marketing Engagement APIs and Programmatic Languages.

2. Set Up a Transactional SMS Send Definition

Create a send definition that contains the message template and delivery configuration.

a. Use your Cilent ID and secret to request an access token for Agentforce Marketing. See Access Token for Server-to-Server Integrations in Agentforce Marketing Engagement APIs and Programmatic Languages. For example:

1curl "https://$MARKETING_CLOUD_SUBDOMAIN.auth.marketingcloudapis.com/v2/token" \
2--request POST \
3--header "Content-Type: application/json" `\`
4--data '{
5    "grant_type": "client_credentials",
6    "client_id": "2bfe9d72a4aae8f06a31025b7536be80",
7    "client_secret": "9d667c2b7fae7a329f32b6df17926154",
8    "scope": "sms_read sms_write sms_send"
9}'

b. Create the SMS definition using the access token received in step 2a. See POST /messaging/v1/sms/definitions in Agentforce Marketing Engagement APIs and Programmatic Languages.

1curl "https://$MARKETING_CLOUD_SUBDOMAIN.rest.marketingcloudapis.com/messaging/v1/sms/definitions/" \
2--request POST \
3--header "Content-Type: application/json" \
4--header "Authorization: Bearer $ACCESS_TOKEN" \
5--data '{
6  "definitionKey": "pwdless_login",
7  "name": "pwdless_login",
8  "content": {
9    "message": "Your login code is: %%token%%"
10  },
11  "subscriptions": {
12    "shortCode": "8201221",
13    "countryCode": "US",
14    "keyword": "PASSWORDLESS_LOGIN"
15  }
16}'

3. Create a Backend Server to Host the Callback URI

This sample code shows how to configure a backend server for Agentforce Marketing integration. The code handles the HTTP POST request from SLAS and uses Marketing Cloud to send the SMS with the OTP to the user.

This sample code is provided for guidance and isn’t production-ready. Make sure that your code is properly tested before deployment.

Note

1import { randomUUID } from 'node:crypto'
2
3const MC_SUBDOMAIN = // MARKETING_CLOUD_SUBDOMAIN
4const MC_CLIENT_ID = // MARKETING_CLOUD_CLIENT_ID
5const MC_CLIENT_SECRET = // MARKETING_CLOUD_ORG_CLIENT_SECRET
6
7export const handler = async (event) => {
8  try {
9    const body = JSON.parse(event.body || '{}')
10    console.log('Received event:', body)
11    const { phone, token, login_id } = body
12
13    // Step 1: Get access token
14    const tokenRes = await fetch(`https://${MC_SUBDOMAIN}.auth.marketingcloudapis.com/v2/token`, {
15      method: 'POST',
16      headers: { 'Content-Type': 'application/json' },
17      body: JSON.stringify({
18        grant_type: 'client_credentials',
19        client_id: MC_CLIENT_ID,
20        client_secret: MC_CLIENT_SECRET,
21        scope: 'sms_read sms_write sms_send'
22      })
23    })
24
25    const { access_token } = await tokenRes.json()
26
27    // Step 2: Send SMS
28    const messageKey = randomUUID()
29    const smsRes = await fetch(`https://${MC_SUBDOMAIN}.rest.marketingcloudapis.com/messaging/v1/sms/messages/${messageKey}`, {
30      method: 'POST',
31      headers: {
32        'Content-Type': 'application/json',
33        Authorization: `Bearer ${access_token}`
34      },
35      body: JSON.stringify({
36        definitionKey: 'pwdless_login_us',
37        recipient: {
38          to: phone,
39          contactKey: login_id,
40          attributes: { token }
41        }
42      })
43    })
44
45    const smsText = await smsRes.text().catch(() => '')
46
47    return {
48      statusCode: 200,
49      body: JSON.stringify({ message: 'SMS request submitted', messageKey, marketingCloudResponse: JSON.parse(smsText)})
50    }
51  } catch (err) {
52    console.error('Error:', err)
53    return { statusCode: 500, body: JSON.stringify({ error: err?.message || 'Unknown error' }) }
54  }
55}

4. Add the Callback URL to Your SLAS Private Client

After creating the backend server, add the URI to the Callback URL list for your SLAS Private Client. See Configure a SLAS Private Client.

Next, continue to Authorize with SMS.

Example B: Amazon SNS

SLAS passwordless login flow with Amazon SNS for SMS integration

This diagram shows the delivery flow using Amazon SNS. The process starts when the storefront app requests a login. SLAS forwards the token to your backend server, which uses the AWS SDK to publish the message directly to the shopper. Because the SDK handles authentication via configuration, no separate token request is required.

Amazon SNS Prerequisites

To integrate passwordless login with Amazon SNS, you must have:

Amazon SNS with production access.
Provisioned SMS short or long codes in Amazon SNS for each country where you have SMS recipients.

1. Create a Backend Server to Host the Callback URI

This sample code shows how to configure a backend server for Amazon SNS integration. The code handles the HTTP POST request from SLAS and uses Amazon SNS to send the SMS with the one-time password to the user.

This sample code is provided for guidance and isn’t production-ready. Make sure that your code is properly tested before deployment.

Note

1import { SNSClient, PublishCommand } from '@aws-sdk/client-sns'
2
3const snsClient = new SNSClient({ region: 'us-east-1' })
4
5export const handler = async (event) => {
6  try {
7    const body = JSON.parse(event.body || '{}')
8    const { phone, token } = body
9
10    await snsClient.send(new PublishCommand({
11      Message: `Your login code is: ${token}`,
12      PhoneNumber: phone // Must be E.164 format
13    }))
14
15    return {
16      statusCode: 200,
17      body: JSON.stringify({ message: 'SMS sent successfully' })
18    }
19  } catch (err) {
20    console.error('Error sending SMS:', err)
21    return {
22      statusCode: 500,
23      body: JSON.stringify({ error: 'Failed to send SMS' })
24    }
25  }
26}

2. Add the Callback URL to Your SLAS Private Client

After creating the backend server, add the URI to the Callback URL list for your SLAS Private Client. See Configure a SLAS Private Client.

Next, continue to Authorize with SMS.

Authorize with SMS

1. Set Environment Variables

To form requests to the SLAS APIs correctly, it helps to set some environment variables first:

Variable	Example Value	Description
`$SFCC_SCAPI_SHORTCODE`	`kv7kzm78`	Short code for your B2C Commerce instance, not the short code that is provisioned for Agentforce Marketing SMS
`$ORGANIZATION_ID`	`abcd_s01`	Organization ID for your B2C Commerce instance
`$CHANNEL_ID`	`SiteGenesis`	Site name (also known as channel name) in Business Manager
`$CALLBACK_URI`	`https://webhook.site/9f44093b-d129-42be-84d3-2f17254df04b`	URI for redirection after authorization
`$CLIENT_ID`	`872daaa2-412e-40c8-a48a-5a56daaef868`	The SLAS client ID
`$USER_ID`	`pia.larson`	The user ID for logging in the shopper
`$ACCESS_TOKEN`	(not provided for security reasons)	Access token from SLAS

If you’re not using a Unix-based operating system, manually replace the variables later in the curl command provided.

Note

2. Request Authorization

This sample request uses the environment variables set earlier and the authorizePasswordlessCustomer endpoint of the SLAS API (not the same as the SLAS Admin API) to authorize a customer via SMS:

1curl "https://$SFCC_SCAPI_SHORTCODE.api.commercecloud.salesforce.com/shopper/auth/v1/organizations/$ORGANIZATION_ID/oauth2/passwordless/login" \
2--request 'POST' \
3--header "Authorization: Basic $ACCESS_TOKEN"
4--data "channel_id=$CHANNEL_ID" \
5--data 'mode=callback' \
6--data "callback_uri=$CALLBACK_URI \
7--data "client_id=$CLIENT_ID \
8--data "user_id=$USER_ID \
9--data 'locale=en-us'

For more details on making API requests for shopper authorization, see the Passwordless Login guide and the SLAS API reference.